diff --git a/BUILD b/BUILD
index 3a5a223..4ae3ed0 100644
--- a/BUILD
+++ b/BUILD
@@ -7,7 +7,7 @@
     srcs = glob(["src/main/java/**/*.java"]),
     manifest_entries = [
         "Gerrit-PluginName: uploadvalidator",
-        "Gerrit-ApiVersion: 2.16",
+        "Gerrit-ApiVersion: 3.0-SNAPSHOT",
         "Gerrit-Module: com.googlesource.gerrit.plugins.uploadvalidator.Module",
     ],
     resources = glob(["src/main/resources/**/*"]),
diff --git a/WORKSPACE b/WORKSPACE
index 1c369b9..c59c513 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -3,7 +3,7 @@
 load("//:bazlets.bzl", "load_bazlets")
 
 load_bazlets(
-    commit = "6af2e084b72d38a3375925c4586ac2278ef95ee9",
+    commit = "631205bc4f7903d3cf656a844cab2bfd6b03f246",
     #local_path = "/home/<user>/projects/bazlets",
 )
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ChangeEmailValidator.java b/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ChangeEmailValidator.java
index 6deb42c..7ee8f95 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ChangeEmailValidator.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ChangeEmailValidator.java
@@ -23,7 +23,6 @@
 import com.google.gerrit.server.config.PluginConfigFactory;
 import com.google.gerrit.server.config.ProjectConfigEntry;
 import com.google.gerrit.server.events.CommitReceivedEvent;
-import com.google.gerrit.server.git.GitRepositoryManager;
 import com.google.gerrit.server.git.validators.CommitValidationException;
 import com.google.gerrit.server.git.validators.CommitValidationListener;
 import com.google.gerrit.server.git.validators.CommitValidationMessage;
@@ -69,18 +68,15 @@
   public static final String KEY_ALLOWED_COMMITTER_EMAIL_PATTERN = "allowedCommitterEmailPattern";
   private final String pluginName;
   private final PluginConfigFactory cfgFactory;
-  private final GitRepositoryManager repoManager;
   private final ValidatorConfig validatorConfig;
 
   @Inject
   ChangeEmailValidator(
       @PluginName String pluginName,
       PluginConfigFactory cfgFactory,
-      GitRepositoryManager repoManager,
       ValidatorConfig validatorConfig) {
     this.pluginName = pluginName;
     this.cfgFactory = cfgFactory;
-    this.repoManager = repoManager;
     this.validatorConfig = validatorConfig;
   }
 
diff --git a/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ValidatorConfig.java b/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ValidatorConfig.java
index c4ae334..5630b48 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ValidatorConfig.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/uploadvalidator/ValidatorConfig.java
@@ -15,7 +15,8 @@
 package com.googlesource.gerrit.plugins.uploadvalidator;
 
 import com.google.gerrit.common.Nullable;
-import com.google.gerrit.common.data.RefConfigSection;
+import com.google.gerrit.common.data.AccessSection;
+import com.google.gerrit.exceptions.StorageException;
 import com.google.gerrit.extensions.annotations.Exports;
 import com.google.gerrit.extensions.api.projects.ProjectConfigEntryType;
 import com.google.gerrit.reviewdb.client.AccountGroup;
@@ -26,7 +27,6 @@
 import com.google.gerrit.server.group.InternalGroup;
 import com.google.gerrit.server.project.RefPatternMatcher;
 import com.google.gerrit.server.query.group.InternalGroupQuery;
-import com.google.gwtorm.server.OrmException;
 import com.google.inject.AbstractModule;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
@@ -103,7 +103,7 @@
       PluginConfig config, String refKey, Project.NameKey projectName) {
     boolean valid = true;
     for (String refPattern : config.getStringList(refKey)) {
-      if (!RefConfigSection.isValid(refPattern)) {
+      if (!AccessSection.isValidRefSectionName(refPattern)) {
         log.error(
             "Invalid {} name/pattern/regex '{}' in {} project's plugin config",
             refKey,
@@ -177,8 +177,8 @@
 
   private AccountGroup.UUID groupUUID(String groupNameOrUUID) {
     Optional<InternalGroup> group =
-        groupByNameFinder.get(new AccountGroup.NameKey(groupNameOrUUID));
-    return group.map(InternalGroup::getGroupUUID).orElse(new AccountGroup.UUID(groupNameOrUUID));
+        groupByNameFinder.get(AccountGroup.nameKey(groupNameOrUUID));
+    return group.map(InternalGroup::getGroupUUID).orElse(AccountGroup.uuid(groupNameOrUUID));
   }
 
   interface GroupByNameFinder {
@@ -198,7 +198,7 @@
     public Optional<InternalGroup> get(AccountGroup.NameKey groupName) {
       try {
         return groupQueryProvider.get().byName(groupName);
-      } catch (OrmException e) {
+      } catch (StorageException e) {
         log.warn(String.format("Cannot lookup group %s by name", groupName.get()), e);
       }
       return Optional.empty();
diff --git a/src/main/resources/Documentation/config.md b/src/main/resources/Documentation/config.md
index 95c6775..e1cf169 100644
--- a/src/main/resources/Documentation/config.md
+++ b/src/main/resources/Documentation/config.md
@@ -307,7 +307,27 @@
     Multiple values are supported.
     Default: nobody is allowed to skip the rules (empty).
 
-    NOTE: When skipGroup isn't defined, all the other skip settings are ignored.
+NOTE: When skipGroup isn't defined, all the other skip settings are ignored.
+
+NOTE: For [system groups](../../../Documentation/access-control.html#system_groups)
+and external groups (e.g.
+[LDAP groups](../../../Documentation/access-control.html#ldap_groups)) the use
+of UUIDs is required. This is because group names are resolved through the
+group index and the group index only contains Gerrit internal groups.
+
+Example for system group:
+
+```
+   [plugin "@PLUGIN@"]
+     skipGroup = global:Registered-Users
+```
+
+Example for external group:
+
+```
+   [plugin "@PLUGIN@"]
+     skipGroup = ldap:Foo
+```
 
 plugin.@PLUGIN@.skipRef
 :    Ref name, pattern or regexp of the branch to skip.
diff --git a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/EmailAwareValidatorConfigTest.java b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/EmailAwareValidatorConfigTest.java
index 8bdb16c..32966c8 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/EmailAwareValidatorConfigTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/EmailAwareValidatorConfigTest.java
@@ -22,7 +22,7 @@
 import org.junit.Test;
 
 public class EmailAwareValidatorConfigTest {
-  private Project.NameKey projectName = new Project.NameKey("testProject");
+  private Project.NameKey projectName = Project.nameKey("testProject");
   private IdentifiedUser anyUser = new FakeUserProvider().get();
 
   @Test
diff --git a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/FakeGroupByNameFinder.java b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/FakeGroupByNameFinder.java
index 69f1b74..72d31e4 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/FakeGroupByNameFinder.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/FakeGroupByNameFinder.java
@@ -17,6 +17,7 @@
 import com.google.common.collect.ImmutableSet;
 import com.google.gerrit.reviewdb.client.AccountGroup;
 import com.google.gerrit.server.group.InternalGroup;
+import java.sql.Timestamp;
 import java.util.Objects;
 import java.util.Optional;
 
@@ -28,9 +29,20 @@
     onlyGroup = Optional.empty();
   }
 
-  public FakeGroupByNameFinder(AccountGroup accountGroup) {
+  public FakeGroupByNameFinder(
+      AccountGroup.NameKey name, AccountGroup.Id id, AccountGroup.UUID uuid, Timestamp createdOn) {
     onlyGroup =
-        Optional.of(InternalGroup.create(accountGroup, ImmutableSet.of(), ImmutableSet.of()));
+        Optional.of(
+            InternalGroup.builder()
+                .setId(id)
+                .setNameKey(name)
+                .setGroupUUID(uuid)
+                .setOwnerGroupUUID(uuid)
+                .setVisibleToAll(false)
+                .setCreatedOn(createdOn)
+                .setMembers(ImmutableSet.of())
+                .setSubgroups(ImmutableSet.of())
+                .build());
   }
 
   @Override
diff --git a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/FakeUserProvider.java b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/FakeUserProvider.java
index 390eeee..ff79961 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/FakeUserProvider.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/FakeUserProvider.java
@@ -43,7 +43,7 @@
 
   private IdentifiedUser createNew(String email) {
     IdentifiedUser user = createMock(IdentifiedUser.class);
-    Account account = new Account(new Account.Id(1), TimeUtil.nowTs());
+    Account account = new Account(Account.id(1), TimeUtil.nowTs());
     account.setPreferredEmail(email);
     expect(user.isIdentifiedUser()).andReturn(true);
     expect(user.asIdentifiedUser()).andReturn(user);
diff --git a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/ProjectAwareValidatorConfigTest.java b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/ProjectAwareValidatorConfigTest.java
index e6e1be7..a5e01c9 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/ProjectAwareValidatorConfigTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/ProjectAwareValidatorConfigTest.java
@@ -22,7 +22,7 @@
 import org.junit.Test;
 
 public class ProjectAwareValidatorConfigTest {
-  private Project.NameKey projectName = new Project.NameKey("testProject");
+  private Project.NameKey projectName = Project.nameKey("testProject");
   private IdentifiedUser anyUser = new FakeUserProvider().get();
 
   @Test
@@ -66,7 +66,7 @@
         "[plugin \"uploadvalidator\"]\n"
             + "   project = test.*\n"
             + "   blockedFileExtension = jar";
-    Project.NameKey otherNameKey = new Project.NameKey("someOtherProject");
+    Project.NameKey otherNameKey = Project.nameKey("someOtherProject");
     ValidatorConfig config = getConfig(configString, projectName);
     ValidatorConfig config2 = getConfig(configString, otherNameKey);
 
@@ -83,8 +83,8 @@
             + "   project = testProject\n"
             + "   project = another.*\n"
             + "   blockedFileExtension = jar";
-    Project.NameKey anotherNameKey = new Project.NameKey("anotherProject");
-    Project.NameKey someOtherNameKey = new Project.NameKey("someOtherProject");
+    Project.NameKey anotherNameKey = Project.nameKey("anotherProject");
+    Project.NameKey someOtherNameKey = Project.nameKey("someOtherProject");
     ValidatorConfig config = getConfig(configString, projectName);
     ValidatorConfig config2 = getConfig(configString, anotherNameKey);
     ValidatorConfig config3 = getConfig(configString, someOtherNameKey);
diff --git a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/RefAwareValidatorConfigTest.java b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/RefAwareValidatorConfigTest.java
index acc2bdc..2e400e1 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/RefAwareValidatorConfigTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/RefAwareValidatorConfigTest.java
@@ -22,7 +22,7 @@
 import org.junit.Test;
 
 public class RefAwareValidatorConfigTest {
-  private final Project.NameKey projectName = new Project.NameKey("testProject");
+  private final Project.NameKey projectName = Project.nameKey("testProject");
   private final IdentifiedUser anyUser = new FakeUserProvider().get();
 
   @Test
diff --git a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/SkipValidationTest.java b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/SkipValidationTest.java
index 56bf317..3310361 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/SkipValidationTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/uploadvalidator/SkipValidationTest.java
@@ -23,7 +23,7 @@
 import org.junit.Test;
 
 public class SkipValidationTest {
-  private final Project.NameKey projectName = new Project.NameKey("testProject");
+  private final Project.NameKey projectName = Project.nameKey("testProject");
   private final IdentifiedUser anyUser = new FakeUserProvider().get();
 
   @Test
@@ -64,11 +64,10 @@
         new ValidatorConfig(
             new FakeConfigFactory(projectName, config),
             new FakeGroupByNameFinder(
-                new AccountGroup(
-                    new AccountGroup.NameKey("testGroupName"),
-                    new AccountGroup.Id(1),
-                    new AccountGroup.UUID("testGroupId"),
-                    TimeUtil.nowTs())));
+                AccountGroup.nameKey("testGroupName"),
+                AccountGroup.id(1),
+                AccountGroup.uuid("testGroupId"),
+                TimeUtil.nowTs()));
 
     assertThat(
             validatorConfig.isEnabledForRef(